Security is foundational, not a feature. This page summarises what we do to protect your data and keep the Service running. It is meant to be honest and verifiable - we do not claim certifications we have not earned.

1. Encryption

In transit

All traffic between you and ShopRunner is encrypted using HTTPS with TLS 1.2 or higher. The mobile app pins to the same encrypted endpoints. We do not accept unencrypted HTTP for any sensitive request.

At rest

Our managed databases and object storage encrypt data at rest using AES-256 by default. Encryption keys are managed by the underlying cloud providers; we do not have access to raw key material.

2. Hosting and Infrastructure

Application + database hosting - provided by Railway, with primary regions in the United Kingdom and European Union.
Object storage - Cloudflare R2, configured to keep customer images in the European region.
Edge protection - Cloudflare handles DDoS mitigation, TLS termination, and bot filtering on internet-facing endpoints.

We use a small number of carefully chosen vendors. See our Privacy Policy for the categories of recipients of your data.

3. Access Controls

Production access is limited to the smallest possible set of engineers, on a need-to-know basis.
Engineering staff use multi-factor authentication on every service that supports it.
Production secrets are stored in encrypted secret managers; never in source control.
Engineers do not access customer business data unless required for a support request you have raised.

4. Authentication and Sessions

Passwords are hashed with a memory-hard, salted algorithm. We never store plaintext passwords.
One-time-passcode (OTP) sign-in is supported via SMS, WhatsApp, and email.
Sessions auto-expire after a period of inactivity and can be revoked from your account.
We rate-limit authentication endpoints to protect against brute-force attacks.

5. Backups and Resilience

Databases are continuously replicated and snapshotted on a regular schedule.
Snapshots are encrypted at rest and retained for a rolling window.
We periodically test restores to make sure backups are usable.
Customer-facing services are designed to gracefully degrade rather than fail catastrophically.

6. Vulnerability Management

Dependencies are monitored for known security advisories and patched on a defined cadence.
Critical vulnerabilities are patched within one business day of public disclosure.
Code changes pass automated checks (type-checking, linting, secret scanning) before reaching production.

7. Incident Response

If we discover or are notified of a security incident affecting your personal data, we will:

Investigate and contain the incident as quickly as possible.
Notify affected customers without undue delay, and within 72 hours where required by UK or EU GDPR.
Report to the Information Commissioner's Office (or other competent authority) where required by law.
Publish a post-incident summary once the situation is resolved, including what we changed to prevent recurrence.

Suspected security issues should be reported to [email protected]. We aim to acknowledge within one business day.

8. Responsible Disclosure

We welcome reports from independent security researchers. If you believe you have found a vulnerability:

Email [email protected] with a clear description and reproduction steps.
Give us a reasonable amount of time to investigate and remediate before public disclosure.
Do not access or exfiltrate customer data beyond what is necessary to demonstrate the issue.
Do not run denial-of-service attacks or large-scale automated scanning against production.

We do not currently run a paid bug-bounty programme, but we will acknowledge reports and credit researchers (with consent) in our security release notes.

9. Contact

Security issues: [email protected]
Privacy questions: [email protected]